Query Regarding Hardware Wallets

[The Sceptical Chymist]

Wow!!!

It's nice to be pleasantly surprised sometimes, and I'm glad you found some useful info in this thread.

At first when I started using this forum a few days ago I thought it was full of spammers trying to increase their post count to qualify for signature campaigns.

Your impression is actually correct; this forum is full of shitposters who write nonsense for bounties/campaigns, but they don't usually migrate over to the hardware wallet section of the forum (because I assume most of them have zero to say about them).  Certain sections are infested with spam like you wouldn't believe, but the technical sections are refreshingly light on the nonsense.

How reliable are HWs in terms of holding funds for long term (maybe 5-6 years into the future)? Like HDDs/thumb drives failing to start or get corrupted, do HWs have any similar issues???

HW's are supposed to be for long-term storage, and I haven't heard any horror stories yet about unrecoverable coins due to a device malfunctioning.  If you have the recovery seed phrase, you're good.

Just FYI, I own a Ledger Nano S and Nano X, and they're both excellent products.  I tried the Keepkey, but I would never recommend it to anyone.  And the only other brand I ever hear anything positive about is Trezor.  Trezor and Ledger have been around for a relatively long time and have established good reputations, which is extremely important IMO.  Good luck with your hunt for a hardware wallet.

[1714127150]

1714127150

[1714127150]

1714127150

[1714127150]

1714127150

[NeuroticFish]

While maintaining large funds on an airgapped device and the rest on a HW is a good option as well, why would holding everything on the HW be a potential problem?

Because HWs are not perfect; because with the right malicious wallet, even HWs can be fooled and money lost.

I think the level of knowledge necessary in order to use both at the same time is much higher than simply using a HW

My point was to "feed" the HW from cold storage. That should happen very seldom - once per year or less. But yes, it needs higher level of knowledge (and I stated that one has to know what's he doing).

The chances of messing up with an airgapped Electrum are higher imo as soon as you don't have that much of an idea what you're really doing.

I've played a little with Tails OS and it was really simple for me. Electrum was there and I only had to make sure it's indeed offline.
Of course, I followed as good as I could Electrum's doc on cold storage.

I've been personally using my Ledger mostly and some paper wallets every now and then, but I trust my Ledger more than any other method of storage and never made even one little mistake through it.

The big question is: how you handle the paper wallets? I know stories of people losing their funds exactly while they were trying to fund their HW.

How reliable are HWs in terms of holding funds for long term (maybe 5-6 years into the future)? Like HDDs/thumb drives failing to start or get corrupted, do HWs have any similar issues???

That's something you really have nothing to worry about. You write the seed down to paper as instructed and the seed can work with most modern wallets. But I didn't read yet stories about HWs broken.
And if it will just "forget" your info, you can easily re-init from the written down seed.

[joniboini]

If you still plan on importing your keys, Satochip and Ellipal claims that they support that. Not sure how good they are since I never used it, so proceed with caution. If you can use other addresses then I don't think it is necessary to import your old keys, just move the coins instead.

[20kevin20]

Because HWs are not perfect; because with the right malicious wallet, even HWs can be fooled and money lost.

Well, I mean cold storage isn't perfect either. There's no perfect way to store your coins, but I have to hear yet about malicious wallets that fool Ledgers. Has there been any before?

The big question is: how you handle the paper wallets? I know stories of people losing their funds exactly while they were trying to fund their HW.

Paper wallets are definitely not how I'd suggest a newbie to store their coins. I just import them using Electrum, but there are lots of ways you can mess up. The point I was trying to make was that I only rarely use them and most often my Ledger, and until today I had zero issues with the HW.

[NeuroticFish]

but I have to hear yet about malicious wallets that fool Ledgers. Has there been any before?

There were quite a number of Ledger vulnerabilities published/fixed this year. Like this: https://cointelegraph.com/news/newly-discovered-ledger-wallet-vulnerability-could-be-disastrous-if-not-fully-patched

There's a malicious Chrome extension that still fools Ledger users.
There are complains here an there over the internet too https://www.reddit.com/r/ledgerwallet/comments/b5omei/funds_got_stolen_from_ledger_nano_s_this_is_no_fud/
Usually it's (correctly) said that it's the user fault since he didn't pay attention on what wallet he installed, so such cases don't get too much attention, but they do exist.

But we're starting to get off-topic... the whole point is that HODL funds better stay offline, not even in a HW. That's my opinion and you can clearly have a different one.

[starseeker]

It's nice to be pleasantly surprised sometimes, and I'm glad you found some useful info in this thread.

Firstly thank you for giving me some of my first Merits here!

Just FYI, I own a Ledger Nano S and Nano X, and they're both excellent products.  I tried the Keepkey, but I would never recommend it to anyone.  And the only other brand I ever hear anything positive about is Trezor.  Trezor and Ledger have been around for a relatively long time and have established good reputations, which is extremely important IMO.  Good luck with your hunt for a hardware wallet.

Yes, that's the big question now. Ledger vs Trezor lol

From what I've read online - Ledger is partially closed-source and a bit difficult to use in terms of usability like upgrading firmware and reinstalling apps, installing/uninstalling apps, low memory etc

While for Trezor, its open-source. And after that security glitch (wherein seed could be recovered from sram by flashing the device with a malicious firmware) in 2017-18 which they have patched it up via a software (firmware) upgrade - I couldn't find any other major/minor flaws with it.

Would like to hear your views on which one is good overall?

I mainly intend to store BTC and Monero. And would be hodling for foreseeable future.

Thanks again!

[starseeker]

There were quite a number of Ledger vulnerabilities published/fixed this year. Like this: https://cointelegraph.com/news/newly-discovered-ledger-wallet-vulnerability-could-be-disastrous-if-not-fully-patched

There's a malicious Chrome extension that still fools Ledger users.
There are complains here an there over the internet too https://www.reddit.com/r/ledgerwallet/comments/b5omei/funds_got_stolen_from_ledger_nano_s_this_is_no_fud/
Usually it's (correctly) said that it's the user fault since he didn't pay attention on what wallet he installed, so such cases don't get too much attention, but they do exist.

But we're starting to get off-topic... the whole point is that HODL funds better stay offline, not even in a HW. That's my opinion and you can clearly have a different one.

So, apart from the (maybe) obvious/oblivious scams that mislead users. From a general usability perspective - Would you recommend Ledgers? or Trezors? And which particular models??

[starseeker]

If you still plan on importing your keys, Satochip and Ellipal claims that they support that. Not sure how good they are since I never used it, so proceed with caution. If you can use other addresses then I don't think it is necessary to import your old keys, just move the coins instead.

Thanks for pointing me in that direction. But somehow those 2 don't inspire me to go that way. Maybe because they aren't that mainstream.

[HCP]

From what I've read online - Ledger is partially closed-source and a bit difficult to use in terms of usability like upgrading firmware and reinstalling apps, installing/uninstalling apps, low memory etc

That's only really relevant to the Nano S... the Nano X has more storage, so you don't need to worry so much about having to uninstall/install apps if you use a lot of different coins. If you only use one or two different coins, then even the Nano S is perfectly fine.

Upgrading firmware on both the Nano S and Nano X is relatively painless. There were some issues previously, on the Nano S, that were caused because people had not updated their devices for a while and the latest firmware was not compatible with their old bootloader. As far as I'm aware, there hasn't been any similar issue in over 2 years. These days it's more just "delays" caused by Ledger's "rolling update" policy as the servers take a bit of a pounding when new updates are released due to the number of devices in circulation.

While for Trezor, its open-source. And after that security glitch (wherein seed could be recovered from sram by flashing the device with a malicious firmware) in 2017-18 which they have patched it up via a software (firmware) upgrade - I couldn't find any other major/minor flaws with it.

There is an "unfixable" flaw with the device, that allows anyone with physical access to the device to extract the 24 word seed mnemonic. The only mitigation to this flaw, is by using the BIP39 passphrase functionality, as that is not stored on the device but used at "runtime" in combination with the 24 word seed mnemonic to derive your actual wallet seed... Trezor recommend users use long and complex passphrases to prevent loss, should your device be stolen etc.

Would like to hear your views on which one is good overall?
I mainly intend to store BTC and Monero. And would be hodling for foreseeable future.

Honestly? Either one will be just fine for your situation... Both Ledger and Trezor support Monero (XMR), as well as BTC obviously. I own both a Nano S and a Trezor ONE. They both have pros/cons. I would like a Nano X/Trezor T, but don't really see the need to upgrade as the extra features offered by the X and T just aren't worth the cost for me personally.

They're both capable devices, compatible with a number of popular wallets (like Mycelium for mobile use and Electrum for desktop use etc) if you don't like Ledger Live or the Trezor web wallet and both support quite a variety of cryptocurrencies.

[NeuroticFish]

So, apart from the (maybe) obvious/oblivious scams that mislead users. From a general usability perspective - Would you recommend Ledgers? or Trezors? And which particular models??

As I said, for every day use, a HW is a very good acquisition. Just I would not keep all the funds on the every day HW, especially if we talk about big money.
About a "particular model", I have a Ledger Nano S and I am happy with it. I wanted something cheap and good. I never had my hands on a Trezor, so I don't know if it's better, it's really up to everybody's taste (but from what I've read keep your choices only between Ledger and Trezor).
The biggest difference between Nano S and Nano X is that on Nano X you can install more apps, which makes sens only if you work with a big number of altcoins (which I don't).


Edit: if you get Ledger, I advise you don't use it with the ledger wallet app, which is quite crappy; just get Electrum (and verify it) and use it with your HW.

[starseeker]

Edit: if you get Ledger, I advise you don't use it with the ledger wallet app, which is quite crappy; just get Electrum (and verify it) and use it with your HW.

Thank you for the inputs. I was of the opinion that I have to use Ledger wallet app on PC if I need to send/receive funds. So, once I get the Ledger -  can I just start using it with Electrum? Do I need to depend on the Ledger PC app for any updates or anything like that?

[o_e_l_e_o]

You need to use Ledger Live to update the firmware on your device, and also to install and uninstall different coin apps. In terms of actually sending and receiving funds, you don't have to use Ledger Live at all (and in fact, I would recommend not using it since it is a privacy risk and has inferior functionality to other wallets). Ledger devices can be used with a variety of bitcoin wallets such as Electrum as discussed above, and also can be used with Monero's GUI wallet.

[Pmalek]

From what I've read online - Ledger is partially closed-source and a bit difficult to use in terms of usability like upgrading firmware and reinstalling apps, installing/uninstalling apps, low memory etc

It is partially closed source, but most of it isn't. The firmware upgrade process has been simplified to the maximum. In the past you needed to connect, disconnect, and reconnect the cable again while holding a combination of buttons. They abandoned that and now you connect the device, click the download button, confirm that a serial code on your device matches with what is displayed on the screen and you are ready to go. Installing/reinstalling apps is a 1-click process, completely beginner-friendly.

Since you intend to use it for Bitcoin and Monero only, the older and cheaper Nano S is good enough. You will have enough memory for a 3rd/4th app even after those 2 are installed. But, if in the future you want to keep 50 different coins on it, you can always uninstall one to install another one in its place. It doesn't affect your holdings in any way. 

You just missed a Ledger Nano S/X promotion where it was possible to get a 20% discount on your products. It expired yesterday.
If you decide to buy one of these, Ledger often gives discounts on their social media. Sometimes it pays to wait a bit.

[odolvlobo]

Edit: if you get Ledger, I advise you don't use it with the ledger wallet app, which is quite crappy; just get Electrum (and verify it) and use it with your HW.

Thank you for the inputs. I was of the opinion that I have to use Ledger wallet app on PC if I need to send/receive funds. So, once I get the Ledger -  can I just start using it with Electrum? Do I need to depend on the Ledger PC app for any updates or anything like that?

Wallets and coins supported by Ledger: https://www.ledger.com/supported-crypto-assets/ (note: Mycelium is not listed but I have used Ledger with Mycelium)
Wallets supported by Trezor: https://wiki.trezor.io/User_manual:Trezor_Apps

[starseeker]

You need to use Ledger Live to update the firmware on your device, and also to install and uninstall different coin apps. In terms of actually sending and receiving funds, you don't have to use Ledger Live at all (and in fact, I would recommend not using it since it is a privacy risk and has inferior functionality to other wallets). Ledger devices can be used with a variety of bitcoin wallets such as Electrum as discussed above, and also can be used with Monero's GUI wallet.

I will make a note of this point. I intend to use the HW with Electrum and MyMonero/Moneroju. Thanks again for helping me out.

[starseeker]

From what I've read online - Ledger is partially closed-source and a bit difficult to use in terms of usability like upgrading firmware and reinstalling apps, installing/uninstalling apps, low memory etc

It is partially closed source, but most of it isn't. The firmware upgrade process has been simplified to the maximum. In the past you needed to connect, disconnect, and reconnect the cable again while holding a combination of buttons. They abandoned that and now you connect the device, click the download button, confirm that a serial code on your device matches with what is displayed on the screen and you are ready to go. Installing/reinstalling apps is a 1-click process, completely beginner-friendly.

Since you intend to use it for Bitcoin and Monero only, the older and cheaper Nano S is good enough. You will have enough memory for a 3rd/4th app even after those 2 are installed. But, if in the future you want to keep 50 different coins on it, you can always uninstall one to install another one in its place. It doesn't affect your holdings in any way. 

You just missed a Ledger Nano S/X promotion where it was possible to get a 20% discount on your products. It expired yesterday.
If you decide to buy one of these, Ledger often gives discounts on their social media. Sometimes it pays to wait a bit.

This is indeed a relief to my eyes. Yeah, looks like I've missed the promo sale. But it's good that I've discussed my queries here and learnt a lot of things I was unaware of.

[o_e_l_e_o]

I intend to use the HW with Electrum and MyMonero/Moneroju.

MyMonero is not compatible with hardware wallets, as far as I am aware. For a desktop wallet you can use with a hardware wallet, you'll need to use the official Monero GUI wallet: https://www.getmonero.org/downloads/#windows

MoneroJu supports Ledger devices.

Yeah, looks like I've missed the promo sale.

Ledger frequently email out discount codes to previous customers to share with their friends, usually in the region of around 10-20%. You can usually find people handing out spare codes on the Ledger subreddit - https://www.reddit.com/r/ledgerwallet/.

Alternatively, if you can wait a couple of months, the last two years Ledger have had a Black Friday sale. Last year it was 30% off, the year before that 50% off.

[starseeker]

I intend to use the HW with Electrum and MyMonero/Moneroju.

MyMonero is not compatible with hardware wallets, as far as I am aware. For a desktop wallet you can use with a hardware wallet, you'll need to use the official Monero GUI wallet: https://www.getmonero.org/downloads/#windows

MoneroJu supports Ledger devices.

Yeah, looks like I've missed the promo sale.

Ledger frequently email out discount codes to previous customers to share with their friends, usually in the region of around 10-20%. You can usually find people handing out spare codes on the Ledger subreddit - https://www.reddit.com/r/ledgerwallet/.

Alternatively, if you can wait a couple of months, the last two years Ledger have had a Black Friday sale. Last year it was 30% off, the year before that 50% off.

But in all honestly, I've been researching this Ledger vs Trezor topic all day. I still haven't figured out which one is better. First I was inclined towards Ledgers but then after learning that the Secure element part is not open-source - I've switched my opinion to Trezor. Then again after learning about the hardware vulnerabilities in Trezor (which are said to be mitigated via firmware updates) - I'm kinda lost in my way.

How do big Hodlers store their coins? Am I being paranoid?

[o_e_l_e_o]

Then again after learning about the hardware vulnerabilities in Trezor (which are said to be mitigated via firmware updates)

The vulnerability in Trezor devices which allows an attacker with physical access to the device extract the seed phrase have not been patched. They are a hardware issue, not a software one, and are therefore unpatchable. The only work around is to also use a long and complex passphrase, which is combined with your seed phrase to generate a different wallet than your seed phrase alone.

How do big Hodlers store their coins? Am I being paranoid?

A bit of paranoia can be a good thing and can make you safer.

I previously used both Ledger and Trezor devices. I stopped using Trezor devices partly because of the unpatchable vulnerability as described above, and partly because of the way they approached said vulnerability and tried to sweep it under the rug rather than warn all their users. If I was picking a hardware wallet, I would pick a Ledger device.

Having said all that, I am more and more moving to using airgapped wallets. Essentially an old computer, laptop, raspberry pi, etc., which is permanently airgapped from the Internet, running a clean install of Linux, and using full disk encryption. It is the most secure way of storing your coins in my opinion, but is both far more difficult to set up and a little more cumbersome to use than a hardware wallet.